Tools gateway

Route agent MCP and tool calls through Dome to enforce authorization, inject credentials, and audit every invocation

The Tools gateway is Dome's MCP ingress for tool traffic at /gateways/<id>/mcp. Dome authenticates the agent, evaluates Rules, injects backend credentials, applies Guards, and audits each invocation.

High-level overview

Every tool call targets a Gateway. Bare /mcp fails closed with a "select a gateway" 400.

A tool call through the Tools gateway looks like this:

An operator adds an MCP server connection, puts it (or its tools) on a Gateway, and grants an agent access.
The agent points an MCP client at https://<host>/gateways/<id>/mcp with a Dome agent token.
Discovery (tools/list) returns membership- and Cedar-filtered tools.
Each tools/call runs admission, Rules, request Guards, egress with injected credentials, response Guards, and audit.

The Tools gateway never exposes backend credentials to the agent.

Endpoints

Path (relative to `/gateways/<id>`)	Role
`/mcp`	MCP Streamable HTTP session and JSON-RPC frames

Point MCP clients at the Gateway's returned mcp_url. Do not omit the /gateways/<id> segment.

The Tools gateway speaks MCP Streamable HTTP only. It does not support the legacy standalone SSE transport, so configure clients for http (or streamable-http), not sse.

Pipeline

Tool calls share these stages:

Ingress: Resolve the Gateway from the path, validate the bearer credential, extract agent identity, check Gateway admission (discovery exempt), verify act-as when present, apply kill switches and rate limits.
Evaluate: Load the workspace Cedar policy and authorize the tool action. Stale policy fails closed.
Egress: Resolve the backend from the tool catalog, inject stored credentials, forward over MCP Streamable HTTP, stdio, or REST catalog.
Filter: Apply response Guards and field-level redaction before the agent sees the result.
Audit: Emit tool.call, filtering, discovery, and denial events stamped with the Gateway id.

Details of credential models, denial wire shapes, and deployment topology live on the Data plane concept.

tools/list stays membership- and Cedar-filtered and does not require a Gateway access grant at the edge. tools/call requires addressability, admission, and Cedar. A tool that is not a member of the addressed Gateway does not appear for that caller.

Egress protocols

Protocol	Use case
MCP Streamable HTTP	Primary protocol for MCP-native backends.
Stdio	Local backends spawned by the gateway runtime.
REST Catalog	HTTP tool discovery and invocation for non-MCP backends.

Next steps

With the Tools gateway model in mind, continue with:

Gateways concept for membership, grants, and URL shape
Data plane concept for the shared pipeline, credentials, and readiness
LLM gateway concept for the sibling model ingress
Tools concept for credentials, catalogs, and reachability
Tools to register MCP and tool connections
Gateways to attach tools to a Gateway